Why You Need Your FERPA Policy in Writing

In Academic Impressions' recent webcast "FERPA Policy and Procedure Audit" (you can order this online training here), FERPA expert Helen Garrett, the dean of enrollment management systems at Lane Community College and recent president of PACRAO (the Pacific Association of Collegiate Registrars and Admissions Officers), gave an in-depth walkthrough on how to review, update, and communicate FERPA policy regularly, to ensure that departments across your campus are in compliance.

One of Garrett's key points in the training was that while this step is frequently overlooked, it is critical to have a written FERPA policy that is regularly updated.

Why This is Important

To illustrate why the policy has to be written and available for reference, Garrett shared a personal anecdote:

"This happened to me. I've been a registrar since 2000, I love FERPA, I love training people on FERPA, and even I was caught up short on having not done this as well as I should have. So even the most skilled registrars aren't always on top of this.

"This is the story I want to share with you:

"A couple of years ago, we went through a pretty intense process for an employee who had not been doing things well and was up for termination, and that doesn't really happen at my community college. It is a very serious process. In the course of going through a termination hearing -- where we actually had lawyers and a judge -- it actually came down to FERPA at the end when it had to be decided whether or not the employee would keep their job. It came down to whether they had violated FERPA policy. They had been granted access to student information in our ERP, which is Banner.

"I was able to tell the attorneys that when I personally had trained staff on how to access our ERP system -- because I also oversee our Banner student information system at our college -- I had told them in the training that they could not access the student records of family or members of their household. But truth be told, I had not actually put that in writing everywhere that I had needed to.

"We completed the termination hearing, and sadly enough, the employee was terminated. But you can bet that I went back and ensured that our FERPA policy was in writing and was shared out among our staff."

What You Need to Do

Helen Garrett emphasizes the importance of taking four steps:

  • Ensure that your policies are written and updated, in case there is a potential violation of FERPA.
  • FERPA law requires that you issue an annual notice of institutional FERPA policy. (Garrett notes, though, that doing so serves more purposes than just compliance. An annual notice is also a service to your students, informing them of their rights. It also helps to manage family members' expectations around student information.)
  • Provide documents for continued FERPA training and reference, especially given faculty and staff turnover.
  • While FERPA law does not mandate regular training, it's a very good idea to provide it and mandate it on your campus.

Garrett recommends that the registrar conduct a regular internal audit of the institution's FERPA policy.